mmt[.]flnance[.]zone

mmt.flnance.zone resolves to the IP address 104.21.17.133, which belongs to Cloudflare’s network (ASN 13335) and is physically located in the United States. The site serves a TLS certificate issued by Google Trust Services under the WE1 label, indicating a valid HTTPS endpoint despite the malicious intent. An HTTP request returns a 403 Forbidden status, and the only metadata extracted from the page is the title “Just a moment…”. Automated fingerprinting reports the presence of Cloudflare Browser Insights, the core Cloudflare reverse‑proxy service, and support for HTTP/3, confirming that the domain is fully protected behind Cloudflare’s edge infrastructure.

The domain was registered through Cloudflare, Inc. and is currently listed on one security blocklist. Active mitigation is applied by PhishDestroy, which blocks traffic to the domain. VirusTotal analysis shows that two out of ninety‑five security vendors have flagged the domain as malicious, while the remaining scanners have not raised an alert. Gridinsoft assigns a trust score of zero out of one hundred, and the overall risk rating is marked as high. The operational status is reported as active, meaning the infrastructure continues to respond to requests.

Beyond the generic page title, no additional content, brand references, or phishing kit identifiers have been disclosed, leaving the exact victim‑targeting methodology uncertain. Defensive teams should add both the domain name and its resolving IP address to DNS and firewall deny lists, enforce outbound TLS inspection to capture any encrypted payload, and monitor for other domains hosted on the same Cloudflare edge node that exhibit similar risk indicators. Ongoing surveillance is recommended to detect any changes in blocklist presence or additional vendor detections that could modify the threat assessment.